Head Mare APT Exploiting TrueConf Server Vulnerabilities to Deploy PhantomCore and PhantomGraph

Since July 2026, the Head Mare APT group has been observed exploiting a chain of vulnerabilities in TrueConf Server (versions 5.3.x, 5.4.x, and 5.5.x) to compromise enterprise conferencing infrastructure. The attackers leverage unauthorized access via TCP port 4307 to trigger remote code execution within an isolated environment, subsequently escalating privileges to NT AUTHORITY\SYSTEM. Once local system access is achieved, the threat actors deploy a PHP web shell ('locale.php') to maintain persistence, conduct infrastructure reconnaissance, and perform supply chain attacks by replacing legitimate TrueConf client installers with versions containing the PhantomCore backdoor. The group further deploys a modular backdoor, PhantomGraph, which uses Microsoft OneDrive for command-and-control communications and establishes persistence through malicious Windows services and registry modifications. This campaign targets critical infrastructure sectors, including energy, manufacturing, and IT, across Russia.

Attack Chain

1. Attackers establish unauthorized connection to the target TrueConf server via TCP port 4307.
2. Attackers transmit and execute a malicious script on the server by exploiting vulnerability KLCERT-26-057.
3. Attackers exploit vulnerability KLCERT-26-058 to escape the isolated execution environment and gain arbitrary code execution.
4. Execution occurs in the context of the NT AUTHORITY\SYSTEM account on the Windows host.
5. Attackers overwrite the '...\public\js\locale.php' file with a web shell to maintain persistent remote access.
6. The web shell is used to perform internal reconnaissance and gain administrative access to the TrueConf database.
7. Attackers inject the PhantomCore backdoor into legitimate TrueConf client installation files.
8. Attackers deploy PhantomGraph modules ('SysExcSvc.dll' and 'SysReadSvc.dll') via PowerShell as Windows services, utilizing OneDrive for C2.

Impact

Successful exploitation allows for full system compromise, data exfiltration from conferencing databases, and supply chain attacks against participants who download backdoored client software. Observed targeting includes critical industries such as energy, transportation, and software development, impacting the integrity of internal communications and potentially providing a pivot point into the broader corporate network.

Recommendation

1. Upgrade all TrueConf Server instances to versions 5.3.9, 5.4.9, or 5.5.5 immediately to remediate the vulnerabilities.
2. Verify the digital signature of all TrueConf client installer files against the official vendor authenticity guidelines to ensure they have not been tampered with.
3. Deploy detection for the creation of non-standard PHP files in the TrueConf installation directory, specifically monitoring for modifications to 'locale.php'.
4. Enable EDR telemetry on all servers hosting TrueConf applications to monitor for unauthorized PowerShell execution and the registration of new Windows services.